rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.
CVSS Score
7.8
EPSS Score
0.004
Published
2019-03-22
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.
CVSS Score
7.8
EPSS Score
0.004
Published
2017-03-27
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
CVSS Score
5.5
EPSS Score
0.004
Published
2017-01-23